Merge pull request fedimint#5812 from dpc/24-08-07-ci-checksums-fix

fix(ci): sign.sh generates wrong checksums

.github/workflows/ci-nix.yml

@@ -514,7 +514,8 @@ jobs:
               cachix push fedimint -c 8 -j 8 $(nix-store --query --references $(readlink -f result)) $(readlink -f result)
               cachix pin fedimint "fedimint-release-$bin:$BUILD_ID" $(readlink -f result)
             fi
-            nix bundle --bundler .# .#$bin -o "bins/$bin-$BUILD_ID" && sha256sum "bins/$bin-$BUILD_ID"
+            # Note: keep in sync with sign.sh
+            nix bundle --bundler .# ".#$bin" -o "bins/$bin-$BUILD_ID" && sha256sum "bins/$bin-$BUILD_ID"
           done
 
       - name: Check version ${{ matrix.build.bins }}

releases/v0.4.0-x86_64-linux.SHA256SUMS

@@ -1,10 +1,10 @@
-6a853b73755edfd5649bc46335ff7308f0eee4e9e25a9d62cab1c6b026d43def  v0.4.0-x86_64-linux/fedimint-cli
-730d8450e5e4c4f2ca3176f7f44ab44b8c019390f973e5d5916d37360c4977cc  v0.4.0-x86_64-linux/fedimint-dbtool
-3d0bdd11bf0e9e55925194b7f0c14e25cadcf10dfe0ed89e8a6fd79a49d05ddc  v0.4.0-x86_64-linux/fedimintd
-5e0c912420754ef986353106f685e242ffe1858b01986d166b8c4da141f6448b  v0.4.0-x86_64-linux/gateway-cli
-1007fca9295bab2ead1274522b490c33ed1fb58f1e3e1a9afc26f22ae4016524  v0.4.0-x86_64-linux/gatewayd
-ae499530bd08653327c0fd2f4293c017e4df3d12a4c62dfd75bf35bdc98c4d9d  v0.4.0-x86_64-linux/nixos/fedimint-cli
-8b359a816a8d866ed35caaa286b05bb63581a0ad8554374454df1959aaf95d56  v0.4.0-x86_64-linux/nixos/fedimint-dbtool
-0eed8de41a7243e66201fc29b1a66a92095bf672002be4025bb507aae9172301  v0.4.0-x86_64-linux/nixos/fedimintd
-4eb2ed656d7793832d6df2c7b33febabd58a49bb6fe90ca78a9f66ae27d65b09  v0.4.0-x86_64-linux/nixos/gateway-cli
-04c6a7446655eeaf682f1c9c09e9210d8de4ae01e9e1da5df00c43aa5c79f0d7  v0.4.0-x86_64-linux/nixos/gatewayd
+bab6af83cbe3841e47d6f06242626d67a4d38a3c979c7b132768851cf9f4d19d  v0.4.0-x86_64-linux/fedimint-cli
+ca9e4e57c5766d7fe4f69616af4a7916d498f748bea0d846c443a7a343730b2c  v0.4.0-x86_64-linux/fedimint-dbtool
+d0849bbc59c9f5cfa9d98f2e6e4665b410b88ecb0f2a4fb5e4965ae9ca17cc03  v0.4.0-x86_64-linux/fedimintd
+7c6a7f4bbfe813b2243e60a41cc9ee29e5b524721bbb7045fd16723a3bb8b74e  v0.4.0-x86_64-linux/gateway-cli
+a444790bef81616a040a2fd795857083d311097ce17748c332bb5f2b7f812bc7  v0.4.0-x86_64-linux/gatewayd
+5dda65e3260e22ed761969bd79dc4407375588303b366de0587d9857b5dff3c7  v0.4.0-x86_64-linux/nixos/fedimint-cli
+2c3d4086ee05c8ce72ee36e036513244ce802d326ce22679a94ece4a92dd33f3  v0.4.0-x86_64-linux/nixos/fedimint-dbtool
+2ac5afee3e642f012efff407a903487dd69aabc6bf356128693753693ef4b314  v0.4.0-x86_64-linux/nixos/fedimintd
+4f565137ef3e9b79cbb99c031dc8b57d70d233a5ef263e247df938d42f379bc8  v0.4.0-x86_64-linux/nixos/gateway-cli
+94afe7e2a47fb242397287abbed84767cadf59094108db747b4caf9b0f991ecc  v0.4.0-x86_64-linux/nixos/gatewayd

releases/v0.4.0-x86_64-linux.SHA256SUMS.asc

@@ -1,16 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 
-iQIzBAABCgAdFiEEkclCN9mfzyRRBSNn0Olytuw8TnwFAmaxBV4ACgkQ0Olytuw8
-Tnw8DQ//czapBKZ2rYFv61dkODftBNjpQ0qlJ57ownUDfKK9MCgkTEVcBKYkndcI
-lqLhYKKv/fT8qUC2T6DCZwBlnvGydNBH23PRHfxNU17gBwKf3ND2YHaWzd97Et6A
-8vKmE4VjQYG2GAIvkERMT2XBnY7VH0fRsRKHZfuDzb/gCA8+T+u4pVtBMV8hVNP4
-Aka7Id+jrANuI1W1Tvcclp4G/aVd8Y/TEYaoPTrnR8yLfjFtFbBjNAgMjatXI9mB
-j/hJbgYTVHgYTMHbziXDVW7aEohg3dLE0IzxA5l/hqXOVXwhINxLJIFG9p3h4YSJ
-aK+Z4kOPn9Jq1K7c4FUFXaiQ5UQ9eizwdI4cGZge/3Trq+X/p0k6hqKXDex2/F5a
-ZpyR8yfWQZrJ154XSmZ/jkJRsqOAX6PPiag/V78HKpPV7CU7sn0H4nZQa2OEKPiI
-ZJOkEmlgziyPbV4We6cISAUiKVm4mISf2ImCDT+dyqZ9Wun0UTJJW161u87gDZsn
-B6h1J+CQ05NATTBcExp5+QS9FO6jfFUfpLdnfSh2J/tC77fl70CiKDwVplN5uzoy
-aS+bceKLNvvUmlAZmvxWlDLWQDQhWubOkUeOCfr/m2meufAl+a44yMzt59/TdGFl
-e4KA9WSPxZBt6Tou6vMaGLpWHZEnag6pVeorpORhuZ4fvwZiZO0=
-=EV21
+iQIzBAABCgAdFiEEkclCN9mfzyRRBSNn0Olytuw8TnwFAmazyOcACgkQ0Olytuw8
+TnyBPw//bZs1ZAzLfzgGYnrGBWbUpRxXOa6tJ1njlL1ZFwYSFxwqZHE85otjIt//
+qwDF64MCQfkhvmsy4S4AxtlexGgRTrz0bRjpHd4uLU0w+zH9sPC5Y5IjX042b7UL
+1XSZwKBkU6SePyh4YpyggwXIHvW/9IDb9PBHX2loj7hoVyt/UhOr9iNWmfTTQqWA
+akEuiVygToxiFcX+xli/b2iU8IzGpdPR12LE/uGMScX1hwiHGsdpi6pRoj1Q1Gnd
+thvOecpnlcjfB5AZhp50PG0JefygeGunBChDG5oKE0KjCOFPhKGbBYU3v35d1lJo
+c5BSaojoAUCsK2QZzkjhKuTzKXHwfoKc/sTAgOA8wDjgXREoBphdAjnPqn4iZrYu
+r/wUvzG+cPnqxa+FXu58ZQ//Ep6QluV+VEyzGqBctcPcNWXQ+m5I3jMaAvrGCXBR
+quwDsS3nFOPfXOBwNSpUUY+/Qq2Cxbxw7oHgVdSIgqmyNWT2K/QcKJW3JDRiGffy
+ZdhfMUwtMdEBkMlXoZozWIDZCfJtWNYW6igzi7fQ2xw0KnjxAxHBhrnKgRLX/Fza
+BZddpFT2dclRu3fAyyGZ6S/BZLqqpQcMlueth0sSUasT2Zro2/aAZMbywYuyEGhx
+5dxfvcQo4m0l8HdhP05DCjnHCA7rx+IBdSUVy6rpdAursqXAvlI=
+=2y/G
 -----END PGP SIGNATURE-----

scripts/release/sign.sh

@@ -24,18 +24,18 @@ fi
 
 # TODO: add gateway-cln-extension once available as an output
 for bin in fedimintd fedimint-cli fedimint-dbtool gateway-cli gatewayd ; do
-  repo="git+file:${REPO_ROOT}?ref=refs/tags/${tag}"
+  # We need to use rev= , see https://github.com/NixOS/nix/issues/11266
+  # NOTE: '^{commit}' is not a mistake, but git rev-parse syntaxh
+  rev="$(git rev-parse "${tag}^{commit}")"
+  repo="git+file:${REPO_ROOT}?rev=${rev}"
   out="$repo#${bin}"
   nix build "$out"
   mkdir -p "${release_dir}/nixos"
   cp -f result/bin/* "${release_dir}/nixos/"
 
   # skip bundles on Darwin (not supported)
   if [[ "$system" != *"-darwin" ]]; then
-    # TODO: re-export pinned bundlers from our own flake, so they are pinned at the release time
-    # and use the bundler exported in the release: '--bundler git+file:?ref/targs/'
-    # TODO: switch back to upstream after https://github.com/matthewbauer/nix-bundle/pull/103 is available
-    nix bundle --bundler "github:dpc/bundlers?branch=24-02-21-tar-deterministic&rev=e8aafe89a11ae0a5f3ce97d1d7d0fcfb354c79eb" "$out" -o result
+    nix bundle --bundler "$repo" "$out" -o result
     cp -f -L result "${release_dir}/$bin"
   fi
 done